[claude]

Fixes #14020

What this changes

One string, in one test title:

packages/plugins/plugin-auth/src/admin-sso-bridge-gate.test.ts:271

-  it('measured vendor posture (installed 1.7.1): an org-less /sso/register admits any authenticated user', ...
+  it('measured vendor posture (then-installed 1.7.1): an org-less /sso/register admits any authenticated user', ...

Nothing else in the file, and nothing else in the repo. No changeset file — see the route note at the bottom.

Why it was false, not merely stale

installed 1.7.1 is a present-tense claim about this tree. On origin/main the tree says otherwise:

packages/plugins/plugin-auth/package.json
  27:    "@better-auth/core": "^1.7.2",
  28:    "@better-auth/oauth-provider": "^1.7.2",
  29:    "@better-auth/scim": "^1.7.2",
  30:    "@better-auth/sso": "^1.7.2",
  37:    "better-auth": "^1.7.2",

pnpm-lock.yaml
  better-auth@1.7.2

So the sentence asserted something about the installed version that the lockfile contradicts. then-installed is the scoping vocabulary scripts/check-vendor-version-stamps.mjs prescribes for exactly this repair — it is in that script's HISTORICAL_SCOPE_MARKERS, and its remedy (b) names the spelling outright:

(b) keep 1.7.1 and SCOPE the sentence to when it was true — the
    cheapest honest repair, and it re-measures nothing. ... or write
    "the then-installed 1.7.1" where it now says "the installed 1.7.1"

It is also the spelling already used across this package (auth-plugin.ts, auth-manager.ts, organization-add-member.ts, vendor-admin-refusal-envelope.ts, and others). The attestation is unchanged: the posture was measured against 1.7.1, and that stays true at every future bump. No measurement was redone and no version number was restamped — restamping without re-measuring is the false-attestation shape that gate exists to prevent.

⛔ What this does NOT do — read this before reading the numbers below

This PR rewrites one false sentence into a true one. It does not repair the class.

The detector still cannot see this class of stamp. The site is unattributed — a family name is inside the window but sits in a different paragraph of the comment block, separated by a bare decoration-only line, and after PR #14017 a name reaches to the end of its sentence and no further. That is the attribution rule working as designed. Before this change the site was counted and never judged; after this change it is still counted and still never judged. If the same shape is written again tomorrow, nothing goes red.

⛔ The attribution rules in scripts/check-vendor-version-stamps.mjs are not touched here, deliberately: block-level attribution with a uniqueness condition (option 2 on the card) is a measured design change needing the same before/after sweep over both populations with the CONTESTED column at zero. It remains an open design question, and it is deliberately not filed as a fix by this PR.

Detector before/after — proving it was not touched, and that its counts moved only as expected

All readouts below are from commit 7f4987fe7, running the detector unmodified.

The gate itself — byte-identical before and after:

check:vendor-version-stamps: OK — 6053 file(s) scanned.
  better-auth: 250 version stamp(s); resolved 1.7.2; 138 name(s) a different version, reported and not enforced.

--census — byte-identical before and after (it lists judged sites, and this site is unattributed, so it never appears there).

--list — exactly one line changes, and its verdict does not:

before:
  [unattributed] packages/plugins/plugin-auth/src/admin-sso-bridge-gate.test.ts:271  (unattributed)@1.7.1  it('measured vendor posture (installed 1.7.1): an org-less /sso/register admits any auth

after:
  [unattributed] packages/plugins/plugin-auth/src/admin-sso-bridge-gate.test.ts:271  (unattributed)@1.7.1  it('measured vendor posture (then-installed 1.7.1): an org-less /sso/register admits any

Still [unattributed]. Whole-population verdict counts are unchanged in both directions: 250 sites = 2 current + 3 fixture + 138 historical + 107 unattributed, before and after.

--attribution-sweep — exactly one cell moves, and it is the counterfactual mechanism, not the shipped one:

                            before                                  after
  legacy char-gap 400   :  250 site(s), 173 attributed, 12 contested, 2 failing   ->   1 failing
  (every other row byte-identical, including all four sentence rows)

That is the honest confirmation the card asked for. The legacy character-window mechanism — the one PR #13981 rejected with numbers, and which this PR does not adopt — would have attributed this site and judged it live-stale. Probed directly through the gate's own exports:

BEFORE (HEAD blob of the file):
  FAILING@gap400  admin-sso-bridge-gate.test.ts:271  [live-stale]  pkg=better-auth  v=1.7.1
      it('measured vendor posture (installed 1.7.1): an org-less /sso/register admits any authenticated user', ...

AFTER (this branch):
  (this site is absent from the failing set)

So the defect was real under any mechanism that can see it; the substance is repaired even though the shipped mechanism's counts do not move.

The one gap-400 failure that remains is the card's own counter-example, unchanged by this PR and left alone on purpose:

FAILING@gap400  packages/plugins/plugin-auth/src/auth-manager.ts:3198  [live-stale]  pkg=better-auth  v=1.6.20
      // That bridge dates from 1.6.20, where @better-auth/sso hardcoded the

That is a permanently true historical sentence, red only because the character window reaches past a sentence boundary and picks up "installed" from the next sentence. A red whose only available repair turns a true sentence into a false one is worse than silence — which is why the reach is not widened here.

--self-test: 64 checks pass.

Verification

Commit 7f4987fe7, worktree off origin/main at a39b02a6b.

• The retitled test executed and passed, by name:
  ✓ src/admin-sso-bridge-gate.test.ts > ... > measured vendor posture (then-installed 1.7.1): an org-less /sso/register admits any authenticated user 19ms
• File-scoped run: Test Files 1 passed (1) / Tests 18 passed (18)
• Whole package: pnpm --filter @objectstack/plugin-auth test — Test Files 87 passed (87) / Tests 1803 passed (1803)
• pnpm --filter @objectstack/plugin-auth typecheck exits 0. ⚠️ Reported as NOT MEASURED for this file, not as coverage: tsc --listFiles shows 0 occurrences of admin-sso-bridge-gate.test.ts in that program. plugin-auth is one of the 16 packages whose tests sit outside tsc, already accounted for in the shrink-only TEST_DEBT ledger; vitest is what exercised this file.
• Derived gate families for this diff (node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, 26 families, harvested with --commands): 25 green. The 26th, scripts/check-test-completeness.mjs, exits 3 = PREREQUISITE NOT MET locally — it needs a saved turbo run test log and says so itself; recorded as NOT MEASURED, not as a pass and not as a red. CI supplies that log.
• check:dual-build-cjs-loads and check:type-check-debt both exit 3 on an unbuilt tree; the full workspace closure was built (turbo run build, 70/70 tasks) and both then re-ran green — check:type-check-debt --re-measure: 27 ledger entr(ies) re-measured, 1217 raw tsc error(s) total, none above its recorded number.
• pnpm check:nul-bytes and node scripts/check-ratchet-remedy-authority.mjs green. check:declared-population-live is not owed: no scripts/** path is touched.

Changeset route

Route 2 of the Check Changeset step, the one it marks PREFERRED: "It releases nothing (... tests-only ...) → apply the skip-changeset label." This diff is a single test-title string, and packages/plugins/plugin-auth publishes files: ["dist", "README.md", "CHANGELOG.md"] — the test file never ships, so no package releases anything. The label is applied on this PR. Route 3, the empty-frontmatter changeset, is closed and was not taken.

Not addressed here

• [finding] The vendor-version-stamp gate does not cover content/docs, and adding it to ROOTS is measurably insufficient #13981 (docs root and prose-distance attribution) is a separate matter and stays as scoped.
• Block-level attribution with a uniqueness condition — option 2 on the card — is an open design question with its own measurement bar. Not attempted here, and no fix filed for it.

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json d63c8a25216c59b9bf2652cf5197aa526a2c00b2 → packageMentionDocs.